If your plants run EtherNet/IP, the security extension built into that protocol just picked up an IEC 62443 certificate. Here is what it does and does not mean for you.
On 22 October, TÜV Rheinland certified ODVA's CIP Security specification as meeting IEC 62443-4-2 at Security Level Capability 3 (SL-C 3). CIP Security is the application-layer security extension for EtherNet/IP and the Common Industrial Protocol. It uses TLS and DTLS to authenticate devices and users, control which commands are allowed, protect data integrity, and encrypt traffic between controllers, drives, I/O and HMIs.
IEC 62443-4-2 is the part of the standard that sets technical security requirements for individual IACS components. SL-C 3 is aimed at attackers with moderate resources, specialist ICS knowledge and moderate motivation.
What it means:
• For manufacturers and vendors: ODVA says the certified specification should cut the work needed to take your own CIP Security products through 62443-4-2, and it gives you a stronger story as EU Cyber Resilience Act requirements come in. It does not certify your product, and it does not make you CRA compliant on its own.
• For integrators: CIP Security only helps if it is turned on and configured. Expect more customer specs that call for it, and plan for certificate and key management in your designs.
• For asset owners: a certified specification is a useful line in a purchasing spec, but the certificate that matters is the one on the actual product and firmware version you install.
Where this shows up from the plant floor to the cloud: EtherNet/IP traffic between PLCs, drives, remote I/O and HMIs in Levels 0 to 2, engineering workstations and historians in Level 3, and the remote access paths into those zones.
What the Red Tiger team recommends now:
1. Inventory your EtherNet/IP devices and note which ones support CIP Security today and which firmware versions they run.
2. Ask vendors for product-level IEC 62443-4-2 certificates, not just the protocol-level claim, and write that into new purchasing specs.
3. Plan the rollout like any crypto change: certificate and key management, testing on a non-production cell, and a clear fallback before you enable it on a live line.
4. Keep the basics in place. Authentication on the wire does not replace zones and conduits, segmentation, and monitoring for unexpected controller changes.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Source: https://www.iotinsider.com/industries/security/cip-security-achieves-iec-62443-4-2-certification-for-industrial-products/
ODVA CIP Security overview: https://www.odva.org/technology-standards/distinct-cip-services/cip-security/
Check out our resources and book a follow-up call with our team.
